d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rtadvd(8): Don't use-after-free

Browse Source 
This whole block of code as committed fully formed in r224144.  I'm not really
sure what the intent was, but it seems plausible that !persist ifis could need
other member cleanup.  Don't free the object until after we've finished
cleaning its members.

Reported by:	Coverity
CID:		1006079
Sponsored by:	EMC / Isilon Storage Division
This commit is contained in:
cem 2016-05-12 04:54:32 +00:00
parent 7403ada3a6
commit 0bb2b5b11d
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
usr.sbin/rtadvd/config.c
View File

@ -234,7 +234,6 @@ rm_ifinfo(struct ifinfo *ifi)
TAILQ_REMOVE(&ifilist, ifi, ifi_next);
syslog(LOG_DEBUG, "<%s>: ifinfo (idx=%d) removed.",
__func__, ifi->ifi_ifindex);
free(ifi);
} else {
/* recreate an empty entry */
update_persist_ifinfo(&ifilist, ifi->ifi_ifname);
@ -278,6 +277,8 @@ rm_ifinfo(struct ifinfo *ifi)
}
syslog(LOG_DEBUG, "<%s> leave (%s).", __func__, ifi->ifi_ifname);
if (!ifi->ifi_persist)
free(ifi);
return (0);
}